. recycle bin doesnt work ( files do not go into it when deleted)
. every few times of starting windows up and logging on, ull.monitor is not working ( apparently due to a warning)) and , about 5 mins later the start toolbar changes colour then the pc automatically reboots for no reason
. advert madness ( even as i type now i am flodded with ads) and i use firefox only, never IE but it still shows IE ads without opening the browser

so this is my hijackthis log. please help. i am at the end of my tether

You have the latest version of VX2. Download L2mfix from one of these two locations:

L2MFixAtribL2MFixSub
Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing enter. This will scan your computer and it may appear nothing is happening, then, after a minute or 2, notepad will open with a log. Copy the contents of that log and paste it into this thread.

From the l2mfix folder on your desktop, double click l2mfix.bat and select option #2 for Run Fix by typing 2 and then pressing enter, then press any key to reboot your computer. After a reboot, your desktop and icons will appear, then disappear (this is normal). L2mfix will continue to scan your computer and when it's finished, notepad will open with a log. Copy the contents of that log and paste it back into this thread, along with a new hijackthis log.

Registry Entries that were Deleted:
Please verify that the listing looks ok.
If there was something deleted wrongly there are backups in the backreg folder.
****************************************************************************
REGEDIT4

If you are unable to connect to the kaspersky site for download or updates please do the following:

Go to:

C:\Windows\system32\drivers\etc\HOSTS <--No extension...and delete the file.
If you get access denied error; right click it, check properties, if "read only" is checked; uncheck it and try to delete the file again.
We will replace it with known good later.

Once you have done that....

Please post new hijack log.

Once I see new log and results of what I asked you to check above will determine what we do next.

Phew!...Thanks!

I'll be on all nite._________________Never give up!
Former Microsoft MVP Windows-Security 2005-2009

Please copy the following instructions to a notepad file and save them
You will need to be Offline and NO IE windows open
You won't see this page.
We also need to shut down explorer.exe so it is important to keep your saved notepad file open and killbox open. Your desktop will dissapear dyring much of this process...normal.

Double click remove.reg
Answer yes to merge/add items to registry
Should get success messege.
That will remove items left over from Narrator in registry.

I see you picked up some new stuff.
iMesh comes bundled with junk. I suggest Uninstalling it.
You can do that in add/remove programs.
There will likely also be an entry in add/remove programs called iMesh ads support
Uninstall that as well.

That is likely your wierd search engine as they will customise popups according to where you are surfing.

Exit IE and disconnect from internet.
Start LSPFix.exe
Check "I know what I am doing"
Move all instances of apptoport.dll (Nothing else!) to the remove pane using the >>
Click finish and close program.

called ISearch
it appears in firefox next to the adress bar, where the quick search engines are. every time i open firefox, it should have a google search- but its ISearch. i can change it back to google though, but only to go back after a new mozilla firefox window is opened

C:\Explorer.exe: not present
C:\WINDOWS\Explorer\Explorer.exe: not present
C:\WINDOWS\System\Explorer.exe: not present
C:\WINDOWS\System32\Explorer.exe: not present
C:\WINDOWS\Command\Explorer.exe: not present
C:\WINDOWS\Fonts\Explorer.exe: not present

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

Click start> run> type services.msc and hit enter.
In next window...
Scroll down to messenger
Double click it to bring up properties.
Click stop
Using pulldown arrow beside "startup type" set it to disabled
Apply and OK changes.
Exit services applet.
We stopped that to shut off the silly "messenger service" spam popups. (has nothing to do with MSN.)

For each of the commands below...if you get error...just continue on to next one.

**Note** If Antivirus warn you of possible melicious script please allow to run. It is not dangerous. All it is doing is searching registry for info we ask and putting results to text file for us to read.

; NOTE: This file will be deleted when you close WordPad.
; You must manually save this file to a new location if you want to refer to it again later.
; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.)

C:\Explorer.exe: not present
C:\WINDOWS\Explorer\Explorer.exe: not present
C:\WINDOWS\System\Explorer.exe: not present
C:\WINDOWS\System32\Explorer.exe: not present
C:\WINDOWS\Command\Explorer.exe: not present
C:\WINDOWS\Fonts\Explorer.exe: not present

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

; NOTE: This file will be deleted when you close WordPad.
; You must manually save this file to a new location if you want to refer to it again later.
; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.)